I have recently upgraded to SA3.2 (via ISPConfig) and have several users
seeing messages come through without any SA processing. On my personal
account, I see 2-5 messages a day which don't have a X-Spam-Status and are
very obviously spam.

SA is called through PROCMAIL and I have confirmed that the messages getting
through aren't too big to get blocked by the PROCMAIL script.

My thoughts are to write another procmail rule at the end to check for the
X-Spam-Status header and if missing feed back into the SA rule. This seems
like an unneeded hack, and I hope someone could point me at some other
troubleshooting ideas.